171176dd3048a4647fa453c77e516e974037829d7d047e51bfcbbccde2bd09f0

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ff35c438bed4cd072bf4b5174578a701_JaffaCakes118.pdf
Size

43KB
MD5

ff35c438bed4cd072bf4b5174578a701
SHA1

8cfd35e5c915a9e5dec2fb8b167b9b41bd22f0b1
SHA256

171176dd3048a4647fa453c77e516e974037829d7d047e51bfcbbccde2bd09f0
SHA512

831d3283b93ebd3aa8094e3030157a73580aa1a09a3590efa24958cb4fe0641ad393e35fff11b34c10935d357d8bd0a0b5a34b1de8d25a382cb3799727a09f0c
SSDEEP

768:VevbdpibTzkcQHkEyR3p1691KmqUqihCoA/z+D0g+u5nF01GnzQABivg/H/StKEy:Uv5pibTzkcQHkEyR3p1691KmqUqihCoB

Score

3^/10

discovery

Malware Config

Signatures

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1648	AcroRd32.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1648	AcroRd32.exe
1648	AcroRd32.exe
1648	AcroRd32.exe

C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ff35c438bed4cd072bf4b5174578a701_JaffaCakes118.pdf"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\9.0\SharedDataEvents

Filesize
3KB

MD5
71a381f5a5ebc4dad50da7c32f4fb661

SHA1
04a4d6423407408d7b4d9616dd0db0f736ef81c0

SHA256
6ae56306d86bb8480be4fc2ede4388ef71dce18e420e04ecc51a60fd6ccc520b

SHA512
d4174830536893d8dbaf9dc95d5ede889949d0c300648a2ed89254803aae420fa66de6811fcc825b54d4d55e8d1a7c4f6c7ef34786c97c07fed0d2af2701e5c1

Download Submit